ClawHub
Back to skill

Security audit

OpenClaw Doctor

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed OpenClaw health-check skill, but it asks the agent to inspect sensitive configuration and memory/workspace files with broad activation and weak scoping.

Install only if you are comfortable with the agent inspecting OpenClaw configuration, cron status, model/channel settings, and memory-related workspace files. Prefer invoking it explicitly for OpenClaw diagnostics, and avoid using it in workspaces where openclaw.json, MEMORY.md, TOOLS.md, or notes may contain secrets or private content unless the skill is tightened to metadata-only checks and pre-redaction.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:14
Finding

Overbroad Access to Sensitive Configuration and Operational Metadata

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-29 and 49-52
Vulnerability Type: Excessive diagnostic access beyond least-privilege requirements
Risk Level: Medium

Relevant Source Excerpt

The following is an English translation of the relevant instructions:

text
### 1. System Status
- OpenClaw version
- Node.js version
- Uptime and memory usage
- Gateway process status

### 2. Configuration Checks
- Whether the configuration file is valid (openclaw.json)
- Channel connection status (Feishu, Telegram, etc.)
- Whether model configuration is correct
- Whether permission settings are reasonable

### 3. Model Connectivity
- Whether the primary model responds normally
- Whether fallback models are available
- Whether API keys are valid

AI invocation steps:
1. Inspect the openclaw.json configuration file
2. Execute `openclaw status` to obtain system status
3. Execute `openclaw cron list` to inspect scheduled tasks

Technical Analysis

The Skill directs an AI agent to inspect the complete openclaw.json configuration file and collect process status, channel connections, model configuration, credential validity, resource consumption, and scheduled-task information.

These checks are consistent with the advertised diagnostic purpose, and the Skill explicitly says not to modify configuration. However, reading an entire configuration file is broader than necessary when the required result is only a health summary. Configuration files can contain API keys, channel credentials, endpoint details, account identifiers, and permission settings. Redacting secrets only in the final report does not prevent those values from first entering model context, execution logs, tool traces, or telemetry.

The instructions do not define an allowlist of fields, require confirmation before credential-related inspection, or mandate redaction before information is passed to the model. This creat ...[truncated 1488 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace full-file inspection with a dedicated status command or parser that returns only explicitly approved fields.
  2. Define an allowlist for configuration properties that may be inspected, such as version identifiers and boolean connectivity status.
  3. Exclude credential values, authorization headers, tokens, private endpoints, and unrelated configuration sections before data reaches model context.
  4. Require explicit user confirmation before inspecting credential status, permission configuration, channel details, or scheduled-task metadata.
  5. Perform secret detection and redaction inside the local tool boundary rather than relying only on the AI to redact its final response.
  6. Return only aggregate cron information unless the user specifically authorizes disclosure of task names and execution details.
  7. Run diagnostic commands with a restricted account and document the minimum required filesystem and command permissions.
  8. Ensure tool traces, telemetry, and debug logs apply the same redaction policy as the final report.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:36
Finding

Unrestricted Inspection of Agent Memory and Workspace Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-39 and 53
Vulnerability Type: Excessive access to persistent agent memory and workspace data
Risk Level: Medium

Relevant Source Excerpt

The following is an English translation of the relevant instructions:

text
### 5. Memory System
- Whether MEMORY.md exists
- The most recent update time for daily notes
- Whether TOOLS.md contains content

4. Inspect workspace files (MEMORY.md, TOOLS.md, etc.)

Technical Analysis

The stated health checks require only file existence, modification time, and whether a file is empty. However, the execution instruction broadly directs the agent to “inspect workspace files” and includes an open-ended “etc.” qualifier. It does not explicitly prohibit reading file contents or constrain inspection to filesystem metadata.

MEMORY.md, daily notes, and TOOLS.md may contain persistent conversation context, user information, private operational notes, tool instructions, internal endpoints, or credentials. An agent may reasonably interpret “inspect” as opening and processing those files, causing unnecessary sensitive content to enter model context.

The Skill does not write to memory and therefore does not constitute memory poisoning. The issue is unauthorized or excessive read access to persistent state, contrary to least-privilege principles.

Attack Path

  1. The health-check Skill is invoked by a user or automated process.
  2. The agent follows the broad instruction to inspect MEMORY.md, TOOLS.md, daily notes, and potentially other workspace files.
  3. Instead of querying only existence, size, and timestamps, the agent reads file contents to determine whether they contain data.
  4. Private memory or operational instructions enter tool output and model context.
  5. The information may be disclosed in the report, retained in conversation history, or captured by execution logs and telemetry.

The rep ...[truncated 879 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace “inspect workspace files” with an explicit metadata-only instruction.
  2. State that the agent must not open, parse, summarize, quote, or transmit the contents of memory, note, or tool files.
  3. Use filesystem metadata operations to retrieve only existence, byte size, and modification time.
  4. Enumerate the exact permitted paths and remove the open-ended “etc.” qualifier.
  5. Resolve and validate canonical paths before inspection to prevent traversal or symlink-based access outside the authorized workspace.
  6. Require explicit user consent before any file-content access is performed.
  7. Report only aggregate results such as “present,” “missing,” “empty,” or “last updated,” without including file contents.
  8. Apply local redaction and logging controls in case metadata tools return unexpected content or errors containing sensitive path information.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented trigger phrase is very broad: users commonly ask an assistant to 'check system status' in many benign contexts, so this skill may auto-activate when not specifically intended. In an agent environment, over-broad triggering can cause the skill to inspect configuration, model, cron, and memory state unnecessarily, increasing the chance of unintended data exposure or tool execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill’s natural-language description, usage instructions, and output template are entirely specified in Chinese, which implies a fixed language/locale behavior. The policy for this audit says to flag language/locale constraints when the skill does not explicitly offer user choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The user-facing description and invocation guidance are presented in Chinese only, which implies a fixed language/locale without opt-in or explanation. Under the policy, forcing a specific language is a natural-language policy concern unless the skill offers a choice or clearly documents a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.